This is a collection of Terraform "core" modules I would consider to be building blocks of every reasonable AWS account setup. Please refer to to the AWS Kickstarter to see their application.

Contributions are more than welcome and encouraged!

• config
• iam-resources
• iam-users
• vpc

The module configures AWS Config to monitor your account for non-compliant resources. You can freely choose which checks to use or discard by modifying the enable_config_rules, disable_config_rules and complex_config_rules variables.

As an example, if you'd wish to enable AUTOSCALING_CAPACITY_REBALANCING and disable the INSTANCES_IN_VPC check, which is enabled by default, you could use the following code:

module "aws_config" {
    source = "git::https://github.com/moritzheiber/terraform-aws-core-modules//config"

    enable_simple_rules = ["AUTOSCALING_CAPACITY_REBALANCING"]
    disable_simple_rules = ["INSTANCE_IN_VPC"]
}

If you wanted to change parameters on the CLOUDWATCH_ALARM_ACTION_CHECK complex rule you could pass it to the complex_config_rules variable:

module "aws_config" {
  source = "git::https://github.com/moritzheiber/terraform-aws-core-modules//config"

  complex_config_rules = {
    CLOUDWATCH_ALARM_ACTION_CHECK = {
      alarmActionRequired            = "false"
      insufficientDataActionRequired = "true"
      okActionRequired               = "true"
    }
  }
}

For a list of available managed rules you can refer to the AWS Config documentation. As a rule of thumb:

• if they require no parameters you can use either enable_config_rules or disable_config_rules to manage them.
• if they require parameters you can use the complex_config_rules map to add them and their input parameters as a identifier = { parameter = value } map.

For both cases you need to use their uppercase, snake case identifier (e.g. autoscaling-capacity-rebalancing becomes AUTOSCALING_CAPACITY_REBALANCING)

For a few rules there is special treatment using variables:

• IAM_PASSWORD_POLICY: See the password_policy variable
• IAM_USER_GROUP_MEMBERSHIP_CHECK: See the iam_user_groups variable
• APPROVED_AMIS_BY_TAG: See the amis_by_tag_key_and_value_list variable
• ACCESS_KEYS_ROTATED: See the max_access_key_age variable
• DESIRED_INSTANCE_TYPE: See the desired_instance_types variable (_Note: the identifier says type but this is a list_)

You can disable any of these complex rules by simply unsetting the corresponding variable.

{
  "CLOUDWATCH_ALARM_ACTION_CHECK": {
    "alarmActionRequired": "true",
    "insufficientDataActionRequired": "false",
    "okActionRequired": "false"
  }
}

[
  "INSTANCES_IN_VPC",
  "EC2_VOLUME_INUSE_CHECK",
  "EIP_ATTACHED",
  "ENCRYPTED_VOLUMES",
  "INCOMING_SSH_DISABLED",
  "CLOUD_TRAIL_ENABLED",
  "IAM_GROUP_HAS_USERS_CHECK",
  "IAM_USER_NO_POLICIES_CHECK",
  "ROOT_ACCOUNT_MFA_ENABLED",
  "S3_BUCKET_PUBLIC_READ_PROHIBITED",
  "S3_BUCKET_PUBLIC_WRITE_PROHIBITED",
  "S3_BUCKET_SSL_REQUESTS_ONLY",
  "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED",
  "S3_BUCKET_VERSIONING_ENABLED",
  "EBS_OPTIMIZED_INSTANCE",
  "AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED",
  "RDS_INSTANCE_PUBLIC_ACCESS_CHECK",
  "RDS_SNAPSHOTS_PUBLIC_PROHIBITED",
  "IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS",
  "IAM_ROOT_ACCESS_KEY_CHECK"
]

{
  "max_password_age": "90",
  "minimum_password_length": "32",
  "password_reuse_prevention": "5",
  "require_lowercase_chars": "true",
  "require_numbers": "true",
  "require_symbols": "true",
  "require_uppercase_chars": "true"
}

A module to configure the "users" account modeled after a common security principle of separating users from resource accounts through a MFA-enabled role-assumption bridge:

These strict separation of privileges follow an article I wrote a while ago. You can also create IAM users and IAM groups with this module and assign the users to specific groups. The module will create two default groups, one for admins and users, which you can disable by setting the admin_group_name and user_group_name to an empty string.

Creating additional users is done by passing a map called users to the module, with a group mapping attached to them (the best practice is to never have users live "outside" of groups).

variable "iam_users" {
  type = map(map(set(string)))
  default = {
    my_user = {
      groups = ["admins"]
    }
  }
}

module "iam_users" {
  source            = "git::https://github.com/moritzheiber/terraform-aws-core-modules.git//iam-users"

  iam_users = var.iam_users
}

This will run the module and create all the necessary permissions along with a user belonging to the admins groups.

{
  "max_password_age": "90",
  "minimum_password_length": "32",
  "password_reuse_prevention": "5",
  "require_lowercase_chars": "true",
  "require_numbers": "true",
  "require_symbols": "true",
  "require_uppercase_chars": "true"
}

A module to configure the "resources" account modelled after the common security principle of separating users from resource accounts through a MFA-enabled role-assumption bridge. Please see the iam-users module for further explanation. It is generally assumed that this module isn't deployed on its own.

module "iam_resources" {
  source            = "git::https://github.com/moritzheiber/terraform-aws-core-modules.git//iam-resources"

This module builds a VPC with the default CIDR range of 10.0.0.0/16, three subnets in a "public" configuration (attached to and routed through an AWS Internet Gateway) and three subnets in a "private" configuration (attached to and routed through three separate AWS NAT Gateways):

Add the following statement to your variables.tf to use the vpc module:

module "core_vpc" {
  source = "git::https://github.com/moritzheiber/terraform-aws-core-modules.git//vpc"

  tags = {
    Resource    = "my_team_name"
    Cost_Center = "my_billing_tag"
  }
}

and run terraform init to download the required module files.

All created subnets will have a tag attached to them which specifies their scope (i.e. "public" for public subnets and "private" for private subnets) which you can use to filter for the right networks using Terraform data sources:

data "aws_vpc" "core" {
tags = {
    # `core_vpc` is the default, the variable is `vpc_name`
    Name = "core_vpc"
  }
}

data "aws_subnets" "public" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.core.id]
  }

  tags = {
    Scope = "Public"
  }
}

data "aws_subnets" "public" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.core.id]
  }

  tags = {
    Scope = "Private"
  }
}

The result is a list of subnet IDs, either in the public or private VPC zone, you can use to create other resources such as Load Balancers or AutoScalingGroups.